raccoon | 1f61adacae43d4fca998951524dfae94f8d7e32445095f3fb8d917697f399e7d

Analysis

max time kernel
147s
max time network
145s
platform
windows7_x64
resource
win7-en-20210920
submitted
29/09/2021, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6e93f6431b00352c8f2afe5070e5217b.exe
Size 1.4MB
Sample210929-13xt6afhd2
SHA256 1f61adacae43d4fca998951524dfae94f8d7e32445095f3fb8d917697f399e7d
MD5 6e93f6431b00352c8f2afe5070e5217b
SHA1 0db355ca7d89a414f44787107693a6e9ed22cbcc
SHA512 943191ab1c6cf6a8c8efc1b3ccfd726241f7e7e38977f6bd9a06b24d85dbcd89e3ec027eb520c11f9375f7d54a29768581b45f95584e172a8b97119fcd51becc
MD5 SHA1 SHA512

Score

10^/10

raccoon c524886d28411e80660e573d1de51f17556d70f6 stealer

Malware Config

Extracted

Family

raccoon

Botnet

c524886d28411e80660e573d1de51f17556d70f6

Attributes

url4cnc
https://t.me/hobabastrepsils

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 1116	2008	6e93f6431b00352c8f2afe5070e5217b.exe	27

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	6e93f6431b00352c8f2afe5070e5217b.exe
Token: 33	2008	6e93f6431b00352c8f2afe5070e5217b.exe
Token: SeIncBasePriorityPrivilege	2008	6e93f6431b00352c8f2afe5070e5217b.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1116	2008	6e93f6431b00352c8f2afe5070e5217b.exe	27
PID 2008 wrote to memory of 1116	2008	6e93f6431b00352c8f2afe5070e5217b.exe	27
PID 2008 wrote to memory of 1116	2008	6e93f6431b00352c8f2afe5070e5217b.exe	27
PID 2008 wrote to memory of 1116	2008	6e93f6431b00352c8f2afe5070e5217b.exe	27
PID 2008 wrote to memory of 1116	2008	6e93f6431b00352c8f2afe5070e5217b.exe	27
PID 2008 wrote to memory of 1116	2008	6e93f6431b00352c8f2afe5070e5217b.exe	27
PID 2008 wrote to memory of 1116	2008	6e93f6431b00352c8f2afe5070e5217b.exe	27
PID 2008 wrote to memory of 1116	2008	6e93f6431b00352c8f2afe5070e5217b.exe	27
PID 2008 wrote to memory of 1116	2008	6e93f6431b00352c8f2afe5070e5217b.exe	27
PID 2008 wrote to memory of 1116	2008	6e93f6431b00352c8f2afe5070e5217b.exe	27

C:\Users\Admin\AppData\Local\Temp\6e93f6431b00352c8f2afe5070e5217b.exe
"C:\Users\Admin\AppData\Local\Temp\6e93f6431b00352c8f2afe5070e5217b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\6e93f6431b00352c8f2afe5070e5217b.exe
  "C:\Users\Admin\AppData\Local\Temp\6e93f6431b00352c8f2afe5070e5217b.exe"
  2⤵
  PID:1116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-55-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/1116-57-0x0000000075FA1000-0x0000000075FA3000-memory.dmp

Download

memory/1116-59-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/2008-53-0x0000000001100000-0x0000000001101000-memory.dmp

Download

memory/2008-54-0x00000000004E0000-0x00000000004FD000-memory.dmp

Download

memory/2008-58-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads